On Sun, Jan 16, 2011 at 08:22:03PM +0100, David Sommerseth wrote:
> Why not have a look at what Fedora and RHEL/CentOS does in that regards?
> They've probably already been through a lot of these decisions as well, and
> were probably also one of the earlier adopters.
Well, most of these distributions offer a targeted SELinux policy approach
(they confine specific services/daemons, but most user activity is ran in
unconfined domains) instead of a strict SELinux policy approach (no
unconfined domains). Although they still have the same problem, it's scope
is not as large as within a strict approach.
The distributions I look at (fedora mainly) doesn't really seem to use
one or the other. I also can't find any resource that sais to developers
how they should focus their policies. From a quick chat on #selinux I seem
to deduce that It Depends (tm). Mostly on the developer in charge.
What I do notice is that, if a module has an allow statement which is
cosmetic (not needed) it doesn't ever get removed because there's noone
"trying" to remove statements to see if they are really cosmetic (that's a
nice conundrum - how do I then know that a rule is cosmetic ;-)
Wkr,
Sven Vermeulen
